Unable to log in as admin to azure

Question

I am having an issue logging in to Azure/M365. So are all other admins.
Error message: invalid_request: AADSTS80002: Internal error. Password validation request timed out. We were unable to either send the authentication request to the internal Hybrid Identity Service

Answer 1

Hello Lindy Long,

The error AADSTS80002 indicates a failure in the Microsoft Entra ID hybrid authentication path, not a local browser or credential issue. Since all admins are affected, this typically occurs when the tenant is configured to use Pass-through Authentication (PTA) or federation (AD FS) and Entra ID cannot reach the on‑premises authentication service in time.

What to check immediately:

1. Confirm the tenant authentication method (Entra admin center → Microsoft Entra ID → Azure AD Connect).
2. If using Pass-through Authentication, verify that at least one PTA agent is running, healthy, and can reach the on‑premises domain controllers.
3. If using AD FS, ensure the AD FS service is running, reachable externally, and certificates are valid.
4. Check Microsoft Entra ID sign-in logs to confirm authentication method and error details.
5. Review Service Health for any Entra ID / Hybrid Identity incidents.

Mitigation / Recovery:

• If any cloud‑only admin account still has access, you can temporarily switch authentication to Password Hash Synchronization (PHS) to restore sign-in.
• If no administrator can sign in, this becomes a tenant-wide admin lockout and requires Microsoft Support / Tenant Recovery assistance to restore access.

Best practice going forward: Always maintain at least one cloud‑only Global Administrator account for emergency access when hybrid authentication is unavailable.

Answer 2

The error indicates a sign-in failure affecting all admins, and it is related to Microsoft Entra ID authentication. The provided context does not contain this specific error code (AADSTS80002) or a documented resolution path for it. However, it does describe general patterns for similar sign-in issues and what to do when admins are locked out.

Because all admins are affected and cannot sign in, this is effectively a tenant-wide admin lockout and must be handled by Microsoft support and the Data Protection/Tenant Recovery process rather than self-service.

Use the following approach:

1. Confirm that the issue is not client-side or MFA input related
   The context shows that some sign-in problems are caused by invalid MFA responses (for example, wrong code or not pressing # on phone calls) and give the generic message “Sorry, our account verification system is having trouble.” Since the error in this case is an internal password validation timeout and affects all admins, it is not a simple MFA input problem and cannot be fixed by changing user input alone.
2. If any other admin can still sign in (even intermittently)
   If at some point another global admin can sign in successfully, that admin should immediately:
   • Open the Microsoft 365 or Azure portal.
   • Use the admin center to open a support ticket describing that all admins intermittently receive AADSTS80002 and cannot sign in.
   • Clearly state that this is impacting all admin accounts and that it appears to be an Entra ID/Hybrid Identity Service issue.
3. If no admin can sign in (sole or all global admins locked out)
   The context describes the supported path when the only global admin (or all global admins) are locked out and cannot access the portal:
   • Contact Microsoft Support by phone using the regional Customer service phone numbers - Microsoft Support page.
   • When interacting with the IVR/bot, clearly indicate:
     • The product is Office 365/Microsoft 365 for business or Azure.
     • The account is a company/organization account.
     • The caller is an administrator.
     • There are no other administrators who can sign in.
     • A service request is needed for a tenant-wide admin sign-in failure.
   • Ask explicitly to be routed to the Data Protection / Tenant Recovery team. This team has tools and processes to verify identity and restore access when admins are locked out and cannot use normal self-service or portal-based support.
   If reaching a live agent is difficult via the phone IVR, the context suggests a workaround:
   • Create a new trial Microsoft 365 tenant (separate from the affected tenant).
   • Sign in to the new tenant’s Microsoft 365 Admin Center.
   • Go to Help & support and open a support ticket. In the ticket:
     • State that the issue is with a different, existing tenant.
     • Provide the affected tenant’s domain and an admin UPN from that tenant.
     • Describe the error AADSTS80002 and that all admins are unable to sign in.
     • Request escalation to the Data Protection team for tenant admin access recovery.
   • After the original tenant issue is resolved, cancel the trial subscription to avoid charges.
4. Why direct support escalation is required
   The context shows that when:
   • Self-service password reset or MFA reset is not possible, and
   • There is no other admin who can sign in to perform recovery actions,
   then only Microsoft support (Data Protection/Tenant Recovery) can verify ownership and restore access. The same principle applies here: an internal Entra/Hybrid Identity error that blocks all admins cannot be fixed from the tenant side and requires Microsoft to investigate and remediate on the service side.

Until Microsoft support engages, there is no documented registry, configuration, or portal-side change in the provided context that can be applied to resolve AADSTS80002 from the tenant’s side.

---

References:

• "Sorry, but we're having trouble signing you in" when a user signs in to Microsoft 365, Azure, or Intune
• Error 80048163 when a federated user tries to sign in to Microsoft 365, Azure, or Intune
• "Account verification system is having trouble" error message when you try to sign in by using a work or school account
• Global Admin Locked out - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I cant log in to my business account because it is requiring Authenticator app which I do not have - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A